mirror of
https://github.com/nearai/ironclaw.git
synced 2026-09-03 08:06:01 +08:00
b6da0272a8
* refactor(tier-b): delete v1 legacy monolith (src/) and cut deploy over to Reborn Removes the v1 `src/` monolith (package `ironclaw_legacy`, binary `ironclaw-legacy`) and its two legacy-only crates (`ironclaw_gateway`, `ironclaw_tui`), then repoints the production deploy pipeline at the already-production-grade Reborn image. This is a real production cutover, not just a code cleanup — see issue #6369 for the tracked capability gaps (sandboxed job execution, TUI/Signal channels, heartbeat, self-repair) that this retirement leaves behind and that were accepted before proceeding. Deletion: - `src/` (v1 monolith), `crates/ironclaw_gateway`, `crates/ironclaw_tui`, root `build.rs` (built the deleted legacy binary's embedded assets). - Root `Cargo.toml` repurposed: the `[package]` is now the test-only host `ironclaw_reborn_integration_tests` for the Reborn integration `[[test]]` suite — it has no lib/bin of its own. - ~89 legacy-coupled `tests/*.rs` files + the legacy `tests/support/` harness; the genuinely Reborn-only tests and shared support submodules are kept. Migration tool decoupling (completes the Tier B follow-up deferred by PR #6368): `ironclaw_reborn_migration` no longer has any `ironclaw_legacy` edge — `tests/migration_roundtrip.rs` now seeds its v1 fixture with raw SQL against a frozen schema snapshot (`tests/fixtures/legacy_v1_schema.sql`), re-encrypting its seeded secret with the same AES-256-GCM + HKDF-SHA256 scheme the frozen decrypt path reads back. Deploy / CI repointed at Reborn: - Root `Dockerfile` is now the Reborn multi-stage build (was `Dockerfile.reborn`); deleted `Dockerfile.worker`, `Dockerfile.test`, `docker/sandbox.Dockerfile`, and `railway.reborn.toml`. - `railway.toml`, `deploy/ironclaw.service`, `deploy/env.example` repointed at the Reborn entrypoint contract. - Deleted orphaned legacy `test.yml`/`e2e.yml` workflows; removed the legacy Docker-worker build, `runtime-staging` target, gateway JS/boundary jobs, and legacy `ironclaw_legacy` build steps from the remaining workflows; repointed the WIT instantiation check at `ironclaw_wasm --test wit_tool_runtime_contract` and the Windows matrix at workspace-wide features. - `classify-test-scope.sh` + self-test and the change-scope regexes drop dead `src/` paths; `check_gateway_boundaries.py` (legacy web gateway) deleted. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * refactor(tier-b): repoint scripts + e2e + docs off the deleted v1 src/ Follow-on cleanup to the src/ deletion. No production code change. Scripts / hooks: - Delete `build-all.sh` (built the deleted `ironclaw-legacy` binary) and `check-i18n-parity.sh` (validated the deleted gateway `.js` language packs; Reborn WebUI i18n is `.ts`, checked by the frontend's `pnpm lint`/`pnpm test`). - `check-version-bumps.sh`: repoint the WIT_TOOL_VERSION cross-check at `crates/ironclaw_wasm/src/config.rs`; drop the channel-WIT constant check (no Reborn host constant exists). - `commit-msg-regression.sh` + `.githooks/pre-commit`: drop the gateway i18n block and repoint the static-asset exemption at `crates/ironclaw_webui/frontend/public/`. - `pre-commit-safety.sh` + its self-test: remove the v1 gateway-specific checks (DISPATCH / CREDNAME / SSE-projection / multi-tenant-broadcast, i18n, gateway-JS) keyed on the deleted `src/channels/web/`; keep the general + Reborn-applicable checks (UTF-8, panics, ARCH-SPRAWL, composition budget). - `composition-budget.toml`: drop the stale `src/slack`/`src/extension_host` exclusion note. E2E: - Delete the 8 legacy-gateway browser scenarios that drove the deleted binary. - Rewrite `tests/e2e/CLAUDE.md` to make Reborn WebChat v2 the sole live surface and flag the remaining legacy `conftest.py` fixtures / `test_v2_*` coupling as a tracked follow-up (issue #6369). CI-gating Reborn scenarios use the separate `reborn_webui_harness` fixture and are unaffected. Docs: - `CLAUDE.md`: replace the `src/` Project Structure tree, "Where to Build", Extension/Auth ownership, Module Specs rows, Database/Channel/Tools/Workspace pointers, and Debugging commands with their Reborn equivalents. - `.claude/rules/*`: drop dead `src/**` frontmatter globs and prose references. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(tier-b): address CI + review findings on the src/ deletion PR - Formatting: `cargo fmt` the migration roundtrip test (raw-SQL rewrite) and smoke.rs (fixes the Formatting / Code Style CI failures). - `tests/dockerfile_runtime_home.rs` (auto-discovered root test, missed in the first pass): repoint its `Dockerfile.reborn` reads at the canonical `Dockerfile`, update the runtime-home assertions to the Reborn image's `/workspace` + `/data/ironclaw-reborn` layout, and update the CI-coverage check to the `docker build --target runtime .` command. This was failing `cargo test --workspace` at runtime. - Railway preview deploy failure: the entrypoint now binds `0.0.0.0` when a Railway runtime is detected (RAILWAY_* markers) and no explicit IRONCLAW_REBORN_SERVE_HOST is set, so the platform health check / ingress can reach the container; the conservative loopback default is preserved off-Railway. Added regression tests for both arms. - `docker.yml`: extract the release version from `crates/ironclaw_reborn_cli/Cargo.toml` (the shipped `ironclaw` package, 1.0.0-rc.1), not the root test-only package (0.1.0), so release image tags are correct. - Dockerfile: pin the `debian:bookworm-slim` runtime base by digest (matches the digest-pinned chef/node stages; the runtime image is the security boundary). - migration_roundtrip.rs: drop the no-op `#[allow(clippy::too_many_arguments)]` on `insert_routine` (6 params, below the threshold). - Cargo.toml: restore the `replay` feature's descriptive comment; stale `-p ironclaw_legacy` run instruction fixed in the live GitHub PAT contract test. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(tier-b): keep the test-host package out of the reborn crate-bucket matrix The `Tests (Reborn)` failure (`Test Reborn crate bucket (adapters-misc)`) came from the root package rename, not a code change. `reborn-tests.yml`'s crate-bucket discovery allowlists any package whose name `startswith("ironclaw_reborn")`. Renaming the root workspace package to `ironclaw_reborn_integration_tests` (Tier B) made it match, so the matrix ran `cargo test -p ironclaw_reborn_integration_tests --all-targets` in a crate bucket — redundantly re-running every reborn `[[test]]` binary. That surfaced `reborn_integration_telegram_journey`'s slack-gate deny-arm scenario, which fails deterministically under the plain `-p <pkg> --all-targets` invocation (it also fails that way on `main` locally; it is only ever green in the `--workspace` integration-coverage lane, and the flat-file int-tier / group discovery never selected it — so it never ran on `main`'s CI at all). Pre-Tier-B this was implicit: the host package was `ironclaw_legacy`, which never matched the allowlist and was not in the `ironclaw` CLI dependency closure, so its `[[test]]` targets only ran via the dedicated root / integration-coverage / group jobs. Exclude the test-host package by name to restore exactly that behavior. The integration `[[test]]` suites continue to run in their owning lanes; no coverage is lost relative to `main`. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
41 lines
1.6 KiB
Plaintext
41 lines
1.6 KiB
Plaintext
# WARNING: Replace all CHANGE_ME values before deploying.
|
|
# Do not use placeholder passwords in production.
|
|
#
|
|
# This is the deploy-target env file for the Reborn `ironclaw` image
|
|
# (docker/reborn/entrypoint.sh). With no CLI arguments the entrypoint runs
|
|
# `serve --host $IRONCLAW_REBORN_SERVE_HOST --port $PORT`. See the repo-root
|
|
# `.env.example` for the exhaustive list of IRONCLAW_REBORN_* variables.
|
|
|
|
# Pin the Docker image version for deterministic deployments.
|
|
# Update this value when deploying a new release.
|
|
# IRONCLAW_VERSION=v1.0.0
|
|
|
|
# --- Reborn serve binding ---
|
|
# 0.0.0.0 binds to all interfaces (required so the published Docker port is
|
|
# reachable). The systemd unit publishes container port 3000.
|
|
IRONCLAW_REBORN_SERVE_HOST=0.0.0.0
|
|
IRONCLAW_REBORN_SERVE_PORT=3000
|
|
|
|
# --- Reborn profile & storage ---
|
|
# `production` seeds the Postgres-backed hosted-multi-tenant config
|
|
# (docker/reborn/config.production.toml). Requires the Postgres URL and a
|
|
# secret master key below.
|
|
IRONCLAW_REBORN_PROFILE=production
|
|
IRONCLAW_REBORN_POSTGRES_URL=postgres://ironclaw:CHANGE_ME@localhost:5432/ironclaw?sslmode=require
|
|
IRONCLAW_REBORN_SECRET_MASTER_KEY=CHANGE_ME
|
|
|
|
# Persistent home for config.toml and any volume-backed state.
|
|
IRONCLAW_REBORN_HOME=/data/ironclaw-reborn
|
|
|
|
# --- Logging ---
|
|
IRONCLAW_REBORN_LOG=info
|
|
|
|
# --- LLM provider (NEAR AI Cloud, API key auth) ---
|
|
# Get an API key from https://cloud.near.ai
|
|
NEARAI_API_KEY=CHANGE_ME
|
|
|
|
# --- WebUI operator access ---
|
|
# Token + user id the WebChat surface authenticates against.
|
|
IRONCLAW_REBORN_WEBUI_TOKEN=CHANGE_ME
|
|
IRONCLAW_REBORN_WEBUI_USER_ID=reborn-cli-operator
|